Description
The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wpa | 2.3-2.3 | — |
| Debian 13 | wpa | 2.3-2.3 | — |
| Debian 12 | wpa | 2.3-2.3 | — |
| Debian 8 | wpa | 2.3-1+deb8u3 | DSA-3397-1 |
| Debian 7 | wpa | 1.0-3+deb7u3 | DSA-3397-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | wpa | 2.1-0ubuntu1.4 | USN-2808-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | wpa_supplicant | 2.2-14.2 | SUSE-SU-2016:2305-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | wpa_supplicant | 2.2-14.2 | SUSE-SU-2016:2305-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | wpa_supplicant | 2.6-1.1 | openSUSE-SU-2024:10499-1 |
Advisories 4
- DSA-3397-1 wpa - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2808-1 wpa vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:2305-1 Security update for wpa_supplicant SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10499-1 wpa_supplicant-2.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-2808-1 vendor-advisory
- 1034592 vdb-entry
- http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt
- http://source.android.com/security/bulletin/2016-01-01.html
- DSA-3397 vendor-advisory
- 77541 vdb-entry
- [oss-security] 20151110 wpa_supplicant unauthorized WNM Sleep Mode GTK control mailing-list